]> andersk Git - openssh.git/blame - channels.c
Oops.. =) mispelt NGROUPS_MAX.
[openssh.git] / channels.c
CommitLineData
8efc0c15 1/*
5260325f 2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
5260325f 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
5260325f 5 * This file contains functions for generic socket connection forwarding.
6 * There is also code for initiating connection forwarding for X11 connections,
7 * arbitrary tcp/ip connections, and the authentication agent connection.
6ae2364d 8 *
bcbf86ec 9 * As far as I am concerned, the code I have written for this software
10 * can be used freely for any purpose. Any derived versions of this
11 * software must be clearly marked as such, and if the derived work is
12 * incompatible with the protocol description in the RFC file, it must be
13 * called by a name other than "ssh" or "Secure Shell".
14 *
15 *
7e7327a1 16 * SSH2 support added by Markus Friedl.
bcbf86ec 17 * Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
18 * Copyright (c) 1999 Dug Song. All rights reserved.
19 * Copyright (c) 1999 Theo de Raadt. All rights reserved.
20 *
21 * Redistribution and use in source and binary forms, with or without
22 * modification, are permitted provided that the following conditions
23 * are met:
24 * 1. Redistributions of source code must retain the above copyright
25 * notice, this list of conditions and the following disclaimer.
26 * 2. Redistributions in binary form must reproduce the above copyright
27 * notice, this list of conditions and the following disclaimer in the
28 * documentation and/or other materials provided with the distribution.
29 *
30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
5260325f 40 */
8efc0c15 41
42#include "includes.h"
61e96248 43RCSID("$OpenBSD: channels.c,v 1.88 2001/02/01 21:58:08 markus Exp $");
42f11eb2 44
45#include <openssl/rsa.h>
46#include <openssl/dsa.h>
8efc0c15 47
48#include "ssh.h"
42f11eb2 49#include "ssh1.h"
50#include "ssh2.h"
8efc0c15 51#include "packet.h"
52#include "xmalloc.h"
53#include "buffer.h"
8efc0c15 54#include "uidswap.h"
42f11eb2 55#include "log.h"
56#include "misc.h"
8efc0c15 57#include "channels.h"
58#include "nchan.h"
59#include "compat.h"
42f11eb2 60#include "canohost.h"
4c8722d9 61#include "key.h"
62#include "authfd.h"
7e7327a1 63
8efc0c15 64/* Maximum number of fake X11 displays to try. */
65#define MAX_DISPLAYS 1000
66
67/* Max len of agent socket */
68#define MAX_SOCKET_NAME 100
69
aa3378df 70/*
71 * Pointer to an array containing all allocated channels. The array is
72 * dynamically extended as needed.
73 */
8efc0c15 74static Channel *channels = NULL;
75
aa3378df 76/*
77 * Size of the channel array. All slots of the array must always be
78 * initialized (at least the type field); unused slots are marked with type
79 * SSH_CHANNEL_FREE.
80 */
8efc0c15 81static int channels_alloc = 0;
82
aa3378df 83/*
84 * Maximum file descriptor value used in any of the channels. This is
85 * updated in channel_allocate.
86 */
39929cdb 87static int channel_max_fd = 0;
8efc0c15 88
89/* Name and directory of socket for authentication agent forwarding. */
90static char *channel_forwarded_auth_socket_name = NULL;
5260325f 91static char *channel_forwarded_auth_socket_dir = NULL;
8efc0c15 92
93/* Saved X11 authentication protocol name. */
94char *x11_saved_proto = NULL;
95
96/* Saved X11 authentication data. This is the real data. */
97char *x11_saved_data = NULL;
1e3b8b07 98u_int x11_saved_data_len = 0;
8efc0c15 99
aa3378df 100/*
101 * Fake X11 authentication data. This is what the server will be sending us;
102 * we should replace any occurrences of this by the real data.
103 */
8efc0c15 104char *x11_fake_data = NULL;
1e3b8b07 105u_int x11_fake_data_len;
8efc0c15 106
aa3378df 107/*
108 * Data structure for storing which hosts are permitted for forward requests.
109 * The local sides of any remote forwards are stored in this array to prevent
110 * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
111 * network (which might be behind a firewall).
112 */
5260325f 113typedef struct {
7368a6c8 114 char *host_to_connect; /* Connect to 'host'. */
115 u_short port_to_connect; /* Connect to 'port'. */
116 u_short listen_port; /* Remote side should listen port number. */
8efc0c15 117} ForwardPermission;
118
119/* List of all permitted host/port pairs to connect. */
120static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
121/* Number of permitted host/port pairs in the array. */
122static int num_permitted_opens = 0;
aa3378df 123/*
124 * If this is true, all opens are permitted. This is the case on the server
125 * on which we have to trust the client anyway, and the user could do
126 * anything after logging in anyway.
127 */
8efc0c15 128static int all_opens_permitted = 0;
129
130/* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
131static int have_hostname_in_open = 0;
132
42f11eb2 133/* AF_UNSPEC or AF_INET or AF_INET6 */
134extern int IPv4or6;
135
8efc0c15 136/* Sets specific protocol options. */
137
6ae2364d 138void
5260325f 139channel_set_options(int hostname_in_open)
8efc0c15 140{
5260325f 141 have_hostname_in_open = hostname_in_open;
8efc0c15 142}
143
aa3378df 144/*
145 * Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually
146 * called by the server, because the user could connect to any port anyway,
147 * and the server has no way to know but to trust the client anyway.
148 */
8efc0c15 149
6ae2364d 150void
5260325f 151channel_permit_all_opens()
8efc0c15 152{
5260325f 153 all_opens_permitted = 1;
8efc0c15 154}
155
7368a6c8 156/* lookup channel by id */
157
158Channel *
159channel_lookup(int id)
160{
161 Channel *c;
3e98362e 162 if (id < 0 || id > channels_alloc) {
7368a6c8 163 log("channel_lookup: %d: bad id", id);
164 return NULL;
165 }
166 c = &channels[id];
167 if (c->type == SSH_CHANNEL_FREE) {
168 log("channel_lookup: %d: bad id: channel free", id);
169 return NULL;
170 }
171 return c;
172}
173
aa3378df 174/*
1d1ffb87 175 * Register filedescriptors for a channel, used when allocating a channel or
0fbe8c74 176 * when the channel consumer/producer is ready, e.g. shell exec'd
aa3378df 177 */
8efc0c15 178
0fbe8c74 179void
a22aff1f 180channel_register_fds(Channel *c, int rfd, int wfd, int efd,
181 int extusage, int nonblock)
8efc0c15 182{
5260325f 183 /* Update the maximum file descriptor value. */
39929cdb 184 channel_max_fd = MAX(channel_max_fd, rfd);
185 channel_max_fd = MAX(channel_max_fd, wfd);
186 channel_max_fd = MAX(channel_max_fd, efd);
187
aa3378df 188 /* XXX set close-on-exec -markus */
1d1ffb87 189
0fbe8c74 190 c->rfd = rfd;
191 c->wfd = wfd;
192 c->sock = (rfd == wfd) ? rfd : -1;
193 c->efd = efd;
194 c->extended_usage = extusage;
a22aff1f 195
196 /* enable nonblocking mode */
197 if (nonblock) {
198 if (rfd != -1)
199 set_nonblock(rfd);
200 if (wfd != -1)
201 set_nonblock(wfd);
202 if (efd != -1)
203 set_nonblock(efd);
204 }
0fbe8c74 205}
206
207/*
208 * Allocate a new channel object and set its type and socket. This will cause
209 * remote_name to be freed.
210 */
211
212int
213channel_new(char *ctype, int type, int rfd, int wfd, int efd,
a22aff1f 214 int window, int maxpack, int extusage, char *remote_name, int nonblock)
0fbe8c74 215{
216 int i, found;
217 Channel *c;
5260325f 218
219 /* Do initial allocation if this is the first call. */
220 if (channels_alloc == 0) {
7e7327a1 221 chan_init();
5260325f 222 channels_alloc = 10;
223 channels = xmalloc(channels_alloc * sizeof(Channel));
224 for (i = 0; i < channels_alloc; i++)
225 channels[i].type = SSH_CHANNEL_FREE;
aa3378df 226 /*
227 * Kludge: arrange a call to channel_stop_listening if we
228 * terminate with fatal().
229 */
5260325f 230 fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
231 }
232 /* Try to find a free slot where to put the new channel. */
233 for (found = -1, i = 0; i < channels_alloc; i++)
234 if (channels[i].type == SSH_CHANNEL_FREE) {
235 /* Found a free slot. */
236 found = i;
237 break;
238 }
239 if (found == -1) {
aa3378df 240 /* There are no free slots. Take last+1 slot and expand the array. */
5260325f 241 found = channels_alloc;
242 channels_alloc += 10;
de273eef 243 debug2("channel: expanding %d", channels_alloc);
5260325f 244 channels = xrealloc(channels, channels_alloc * sizeof(Channel));
245 for (i = found; i < channels_alloc; i++)
246 channels[i].type = SSH_CHANNEL_FREE;
247 }
248 /* Initialize and return new channel number. */
249 c = &channels[found];
250 buffer_init(&c->input);
251 buffer_init(&c->output);
7368a6c8 252 buffer_init(&c->extended);
5260325f 253 chan_init_iostates(c);
a22aff1f 254 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
5260325f 255 c->self = found;
256 c->type = type;
7368a6c8 257 c->ctype = ctype;
0b242b12 258 c->local_window = window;
259 c->local_window_max = window;
260 c->local_consumed = 0;
261 c->local_maxpacket = maxpack;
5260325f 262 c->remote_id = -1;
263 c->remote_name = remote_name;
7368a6c8 264 c->remote_window = 0;
265 c->remote_maxpacket = 0;
266 c->cb_fn = NULL;
267 c->cb_arg = NULL;
268 c->cb_event = 0;
269 c->dettach_user = NULL;
2e73a022 270 c->input_filter = NULL;
5260325f 271 debug("channel %d: new [%s]", found, remote_name);
272 return found;
8efc0c15 273}
0fbe8c74 274/* old interface XXX */
6ae2364d 275int
7368a6c8 276channel_allocate(int type, int sock, char *remote_name)
277{
a22aff1f 278 return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);
7368a6c8 279}
8efc0c15 280
0fbe8c74 281
282/* Close all channel fd/socket. */
283
284void
285channel_close_fds(Channel *c)
286{
287 if (c->sock != -1) {
288 close(c->sock);
289 c->sock = -1;
290 }
291 if (c->rfd != -1) {
292 close(c->rfd);
293 c->rfd = -1;
294 }
295 if (c->wfd != -1) {
296 close(c->wfd);
297 c->wfd = -1;
298 }
299 if (c->efd != -1) {
300 close(c->efd);
301 c->efd = -1;
302 }
303}
304
305/* Free the channel and close its fd/socket. */
8efc0c15 306
6ae2364d 307void
7368a6c8 308channel_free(int id)
8efc0c15 309{
7368a6c8 310 Channel *c = channel_lookup(id);
b148018f 311 char *s = channel_open_message();
312
7368a6c8 313 if (c == NULL)
314 packet_disconnect("channel free: bad local channel %d", id);
b148018f 315 debug("channel_free: channel %d: status: %s", id, s);
316 xfree(s);
317
7e7327a1 318 if (c->dettach_user != NULL) {
319 debug("channel_free: channel %d: dettaching channel user", id);
320 c->dettach_user(c->self, NULL);
321 }
0fbe8c74 322 if (c->sock != -1)
7368a6c8 323 shutdown(c->sock, SHUT_RDWR);
0fbe8c74 324 channel_close_fds(c);
7368a6c8 325 buffer_free(&c->input);
326 buffer_free(&c->output);
327 buffer_free(&c->extended);
328 c->type = SSH_CHANNEL_FREE;
329 if (c->remote_name) {
330 xfree(c->remote_name);
331 c->remote_name = NULL;
5260325f 332 }
8efc0c15 333}
334
aa3378df 335/*
7368a6c8 336 * 'channel_pre*' are called just before select() to add any bits relevant to
337 * channels in the select bitmasks.
aa3378df 338 */
7368a6c8 339/*
340 * 'channel_post*': perform any appropriate operations for channels which
341 * have events pending.
342 */
343typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
344chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
345chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
8efc0c15 346
7368a6c8 347void
348channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
8efc0c15 349{
7368a6c8 350 FD_SET(c->sock, readset);
351}
5260325f 352
97fb6912 353void
354channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)
355{
356 debug3("channel %d: waiting for connection", c->self);
357 FD_SET(c->sock, writeset);
358}
359
7368a6c8 360void
361channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
362{
363 if (buffer_len(&c->input) < packet_get_maxsize())
364 FD_SET(c->sock, readset);
365 if (buffer_len(&c->output) > 0)
366 FD_SET(c->sock, writeset);
367}
5260325f 368
7368a6c8 369void
370channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
371{
372 /* test whether sockets are 'alive' for read/write */
373 if (c->istate == CHAN_INPUT_OPEN)
374 if (buffer_len(&c->input) < packet_get_maxsize())
375 FD_SET(c->sock, readset);
376 if (c->ostate == CHAN_OUTPUT_OPEN ||
377 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
378 if (buffer_len(&c->output) > 0) {
379 FD_SET(c->sock, writeset);
380 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
381 chan_obuf_empty(c);
382 }
383 }
384}
5260325f 385
7e7327a1 386void
387channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
388{
389 if (c->istate == CHAN_INPUT_OPEN &&
390 c->remote_window > 0 &&
391 buffer_len(&c->input) < c->remote_window)
392 FD_SET(c->rfd, readset);
393 if (c->ostate == CHAN_OUTPUT_OPEN ||
394 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
395 if (buffer_len(&c->output) > 0) {
396 FD_SET(c->wfd, writeset);
397 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
398 chan_obuf_empty(c);
399 }
400 }
401 /** XXX check close conditions, too */
402 if (c->efd != -1) {
403 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
404 buffer_len(&c->extended) > 0)
405 FD_SET(c->efd, writeset);
406 else if (c->extended_usage == CHAN_EXTENDED_READ &&
407 buffer_len(&c->extended) < c->remote_window)
408 FD_SET(c->efd, readset);
409 }
410}
411
7368a6c8 412void
413channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
414{
415 if (buffer_len(&c->input) == 0) {
416 packet_start(SSH_MSG_CHANNEL_CLOSE);
417 packet_put_int(c->remote_id);
418 packet_send();
419 c->type = SSH_CHANNEL_CLOSED;
420 debug("Closing channel %d after input drain.", c->self);
421 }
422}
5260325f 423
7368a6c8 424void
425channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
426{
427 if (buffer_len(&c->output) == 0)
428 channel_free(c->self);
6ae2364d 429 else
7368a6c8 430 FD_SET(c->sock, writeset);
431}
5260325f 432
7368a6c8 433/*
434 * This is a special state for X11 authentication spoofing. An opened X11
435 * connection (when authentication spoofing is being done) remains in this
436 * state until the first packet has been completely read. The authentication
437 * data in that packet is then substituted by the real data if it matches the
438 * fake data, and the channel is put into normal mode.
0b242b12 439 * XXX All this happens at the client side.
7368a6c8 440 */
441int
442x11_open_helper(Channel *c)
443{
1e3b8b07 444 u_char *ucp;
445 u_int proto_len, data_len;
5260325f 446
7368a6c8 447 /* Check if the fixed size part of the packet is in buffer. */
448 if (buffer_len(&c->output) < 12)
449 return 0;
450
451 /* Parse the lengths of variable-length fields. */
1e3b8b07 452 ucp = (u_char *) buffer_ptr(&c->output);
7368a6c8 453 if (ucp[0] == 0x42) { /* Byte order MSB first. */
454 proto_len = 256 * ucp[6] + ucp[7];
455 data_len = 256 * ucp[8] + ucp[9];
456 } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */
457 proto_len = ucp[6] + 256 * ucp[7];
458 data_len = ucp[8] + 256 * ucp[9];
459 } else {
460 debug("Initial X11 packet contains bad byte order byte: 0x%x",
461 ucp[0]);
462 return -1;
463 }
5260325f 464
7368a6c8 465 /* Check if the whole packet is in buffer. */
466 if (buffer_len(&c->output) <
467 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
468 return 0;
5260325f 469
7368a6c8 470 /* Check if authentication protocol matches. */
471 if (proto_len != strlen(x11_saved_proto) ||
472 memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
473 debug("X11 connection uses different authentication protocol.");
474 return -1;
475 }
476 /* Check if authentication data matches our fake data. */
477 if (data_len != x11_fake_data_len ||
478 memcmp(ucp + 12 + ((proto_len + 3) & ~3),
479 x11_fake_data, x11_fake_data_len) != 0) {
480 debug("X11 auth data does not match fake data.");
481 return -1;
482 }
483 /* Check fake data length */
484 if (x11_fake_data_len != x11_saved_data_len) {
485 error("X11 fake_data_len %d != saved_data_len %d",
486 x11_fake_data_len, x11_saved_data_len);
487 return -1;
488 }
489 /*
490 * Received authentication protocol and data match
491 * our fake data. Substitute the fake data with real
492 * data.
493 */
494 memcpy(ucp + 12 + ((proto_len + 3) & ~3),
495 x11_saved_data, x11_saved_data_len);
496 return 1;
497}
5260325f 498
7368a6c8 499void
500channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
501{
502 int ret = x11_open_helper(c);
503 if (ret == 1) {
504 /* Start normal processing for the channel. */
505 c->type = SSH_CHANNEL_OPEN;
a8be9f80 506 channel_pre_open_13(c, readset, writeset);
7368a6c8 507 } else if (ret == -1) {
508 /*
509 * We have received an X11 connection that has bad
510 * authentication information.
511 */
512 log("X11 connection rejected because of wrong authentication.\r\n");
513 buffer_clear(&c->input);
514 buffer_clear(&c->output);
515 close(c->sock);
516 c->sock = -1;
517 c->type = SSH_CHANNEL_CLOSED;
518 packet_start(SSH_MSG_CHANNEL_CLOSE);
519 packet_put_int(c->remote_id);
520 packet_send();
521 }
522}
5260325f 523
7368a6c8 524void
0b242b12 525channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
7368a6c8 526{
527 int ret = x11_open_helper(c);
528 if (ret == 1) {
529 c->type = SSH_CHANNEL_OPEN;
d0c832f3 530 if (compat20)
531 channel_pre_open_20(c, readset, writeset);
532 else
533 channel_pre_open_15(c, readset, writeset);
7368a6c8 534 } else if (ret == -1) {
535 debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
0b242b12 536 chan_read_failed(c); /** force close? */
7368a6c8 537 chan_write_failed(c);
538 debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
539 }
540}
5260325f 541
7368a6c8 542/* This is our fake X11 server socket. */
543void
544channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
545{
546 struct sockaddr addr;
547 int newsock, newch;
548 socklen_t addrlen;
865ac82e 549 char buf[16384], *remote_ipaddr;
0b242b12 550 int remote_port;
7368a6c8 551
552 if (FD_ISSET(c->sock, readset)) {
553 debug("X11 connection requested.");
554 addrlen = sizeof(addr);
555 newsock = accept(c->sock, &addr, &addrlen);
556 if (newsock < 0) {
557 error("accept: %.100s", strerror(errno));
558 return;
5260325f 559 }
865ac82e 560 remote_ipaddr = get_peer_ipaddr(newsock);
0b242b12 561 remote_port = get_peer_port(newsock);
7368a6c8 562 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
865ac82e 563 remote_ipaddr, remote_port);
0b242b12 564
565 newch = channel_new("x11",
566 SSH_CHANNEL_OPENING, newsock, newsock, -1,
567 c->local_window_max, c->local_maxpacket,
a22aff1f 568 0, xstrdup(buf), 1);
0b242b12 569 if (compat20) {
570 packet_start(SSH2_MSG_CHANNEL_OPEN);
571 packet_put_cstring("x11");
572 packet_put_int(newch);
573 packet_put_int(c->local_window_max);
574 packet_put_int(c->local_maxpacket);
865ac82e 575 /* originator ipaddr and port */
576 packet_put_cstring(remote_ipaddr);
d0c832f3 577 if (datafellows & SSH_BUG_X11FWD) {
578 debug("ssh2 x11 bug compat mode");
579 } else {
580 packet_put_int(remote_port);
581 }
0b242b12 582 packet_send();
583 } else {
584 packet_start(SSH_SMSG_X11_OPEN);
585 packet_put_int(newch);
586 if (have_hostname_in_open)
587 packet_put_string(buf, strlen(buf));
588 packet_send();
589 }
865ac82e 590 xfree(remote_ipaddr);
8efc0c15 591 }
8efc0c15 592}
593
aa3378df 594/*
7368a6c8 595 * This socket is listening for connections to a forwarded TCP/IP port.
aa3378df 596 */
7368a6c8 597void
598channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
599{
600 struct sockaddr addr;
601 int newsock, newch;
602 socklen_t addrlen;
61e96248 603 char buf[1024], *remote_ipaddr, *rtype;
7368a6c8 604 int remote_port;
605
fa08c86b 606 rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ?
607 "forwarded-tcpip" : "direct-tcpip";
608
7368a6c8 609 if (FD_ISSET(c->sock, readset)) {
610 debug("Connection to port %d forwarding "
611 "to %.100s port %d requested.",
612 c->listening_port, c->path, c->host_port);
613 addrlen = sizeof(addr);
614 newsock = accept(c->sock, &addr, &addrlen);
615 if (newsock < 0) {
616 error("accept: %.100s", strerror(errno));
617 return;
618 }
61e96248 619 remote_ipaddr = get_peer_ipaddr(newsock);
7368a6c8 620 remote_port = get_peer_port(newsock);
621 snprintf(buf, sizeof buf,
622 "listen port %d for %.100s port %d, "
623 "connect from %.200s port %d",
624 c->listening_port, c->path, c->host_port,
61e96248 625 remote_ipaddr, remote_port);
fa08c86b 626
627 newch = channel_new(rtype,
7368a6c8 628 SSH_CHANNEL_OPENING, newsock, newsock, -1,
629 c->local_window_max, c->local_maxpacket,
a22aff1f 630 0, xstrdup(buf), 1);
7e7327a1 631 if (compat20) {
632 packet_start(SSH2_MSG_CHANNEL_OPEN);
fa08c86b 633 packet_put_cstring(rtype);
7e7327a1 634 packet_put_int(newch);
635 packet_put_int(c->local_window_max);
636 packet_put_int(c->local_maxpacket);
fa08c86b 637 if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
638 /* listen address, port */
639 packet_put_string(c->path, strlen(c->path));
640 packet_put_int(c->listening_port);
641 } else {
642 /* target host, port */
643 packet_put_string(c->path, strlen(c->path));
644 packet_put_int(c->host_port);
645 }
6ae2364d 646 /* originator host and port */
61e96248 647 packet_put_cstring(remote_ipaddr);
7e7327a1 648 packet_put_int(remote_port);
649 packet_send();
650 } else {
651 packet_start(SSH_MSG_PORT_OPEN);
652 packet_put_int(newch);
653 packet_put_string(c->path, strlen(c->path));
654 packet_put_int(c->host_port);
655 if (have_hostname_in_open) {
656 packet_put_string(buf, strlen(buf));
657 }
658 packet_send();
7368a6c8 659 }
61e96248 660 xfree(remote_ipaddr);
7368a6c8 661 }
662}
8efc0c15 663
7368a6c8 664/*
665 * This is the authentication agent socket listening for connections from
666 * clients.
667 */
668void
669channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
8efc0c15 670{
5260325f 671 struct sockaddr addr;
7368a6c8 672 int newsock, newch;
48e671d5 673 socklen_t addrlen;
5260325f 674
7368a6c8 675 if (FD_ISSET(c->sock, readset)) {
676 addrlen = sizeof(addr);
677 newsock = accept(c->sock, &addr, &addrlen);
678 if (newsock < 0) {
679 error("accept from auth socket: %.100s", strerror(errno));
680 return;
681 }
fa08c86b 682 newch = channel_new("accepted auth socket",
683 SSH_CHANNEL_OPENING, newsock, newsock, -1,
684 c->local_window_max, c->local_maxpacket,
685 0, xstrdup("accepted auth socket"), 1);
686 if (compat20) {
687 packet_start(SSH2_MSG_CHANNEL_OPEN);
688 packet_put_cstring("auth-agent@openssh.com");
689 packet_put_int(newch);
690 packet_put_int(c->local_window_max);
691 packet_put_int(c->local_maxpacket);
692 } else {
693 packet_start(SSH_SMSG_AGENT_OPEN);
694 packet_put_int(newch);
695 }
7368a6c8 696 packet_send();
697 }
698}
5260325f 699
97fb6912 700void
701channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
702{
703 if (FD_ISSET(c->sock, writeset)) {
704 int err = 0;
705 int sz = sizeof(err);
706 c->type = SSH_CHANNEL_OPEN;
707 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) {
708 debug("getsockopt SO_ERROR failed");
709 } else {
710 if (err == 0) {
711 debug("channel %d: connected)", c->self);
712 } else {
713 debug("channel %d: not connected: %s",
714 c->self, strerror(err));
715 chan_read_failed(c);
716 chan_write_failed(c);
717 }
718 }
719 }
720}
721
7368a6c8 722int
723channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
724{
725 char buf[16*1024];
726 int len;
727
728 if (c->rfd != -1 &&
729 FD_ISSET(c->rfd, readset)) {
730 len = read(c->rfd, buf, sizeof(buf));
0fbe8c74 731 if (len < 0 && (errno == EINTR || errno == EAGAIN))
732 return 1;
7368a6c8 733 if (len <= 0) {
0b242b12 734 debug("channel %d: read<=0 rfd %d len %d",
7368a6c8 735 c->self, c->rfd, len);
736 if (compat13) {
737 buffer_consume(&c->output, buffer_len(&c->output));
738 c->type = SSH_CHANNEL_INPUT_DRAINING;
739 debug("Channel %d status set to input draining.", c->self);
740 } else {
741 chan_read_failed(c);
5260325f 742 }
7368a6c8 743 return -1;
744 }
2e73a022 745 if(c->input_filter != NULL) {
746 if (c->input_filter(c, buf, len) == -1) {
747 debug("filter stops channel %d", c->self);
748 chan_read_failed(c);
749 }
750 } else {
751 buffer_append(&c->input, buf, len);
752 }
7368a6c8 753 }
754 return 1;
755}
756int
757channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
758{
759 int len;
760
761 /* Send buffered output data to the socket. */
762 if (c->wfd != -1 &&
763 FD_ISSET(c->wfd, writeset) &&
764 buffer_len(&c->output) > 0) {
765 len = write(c->wfd, buffer_ptr(&c->output),
0fbe8c74 766 buffer_len(&c->output));
767 if (len < 0 && (errno == EINTR || errno == EAGAIN))
768 return 1;
7368a6c8 769 if (len <= 0) {
770 if (compat13) {
771 buffer_consume(&c->output, buffer_len(&c->output));
772 debug("Channel %d status set to input draining.", c->self);
773 c->type = SSH_CHANNEL_INPUT_DRAINING;
774 } else {
775 chan_write_failed(c);
5260325f 776 }
7368a6c8 777 return -1;
778 }
779 buffer_consume(&c->output, len);
7e7327a1 780 if (compat20 && len > 0) {
781 c->local_consumed += len;
782 }
783 }
784 return 1;
785}
786int
787channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
788{
789 char buf[16*1024];
790 int len;
791
8ce64345 792/** XXX handle drain efd, too */
7e7327a1 793 if (c->efd != -1) {
794 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
795 FD_ISSET(c->efd, writeset) &&
796 buffer_len(&c->extended) > 0) {
797 len = write(c->efd, buffer_ptr(&c->extended),
798 buffer_len(&c->extended));
de273eef 799 debug2("channel %d: written %d to efd %d",
7e7327a1 800 c->self, len, c->efd);
801 if (len > 0) {
802 buffer_consume(&c->extended, len);
803 c->local_consumed += len;
804 }
805 } else if (c->extended_usage == CHAN_EXTENDED_READ &&
806 FD_ISSET(c->efd, readset)) {
807 len = read(c->efd, buf, sizeof(buf));
de273eef 808 debug2("channel %d: read %d from efd %d",
7e7327a1 809 c->self, len, c->efd);
8ce64345 810 if (len == 0) {
811 debug("channel %d: closing efd %d",
812 c->self, c->efd);
813 close(c->efd);
814 c->efd = -1;
815 } else if (len > 0)
7e7327a1 816 buffer_append(&c->extended, buf, len);
817 }
818 }
819 return 1;
820}
821int
822channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
823{
e78a59f5 824 if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
7e7327a1 825 c->local_window < c->local_window_max/2 &&
826 c->local_consumed > 0) {
827 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
828 packet_put_int(c->remote_id);
829 packet_put_int(c->local_consumed);
830 packet_send();
de273eef 831 debug2("channel %d: window %d sent adjust %d",
7e7327a1 832 c->self, c->local_window,
833 c->local_consumed);
834 c->local_window += c->local_consumed;
835 c->local_consumed = 0;
7368a6c8 836 }
837 return 1;
838}
5260325f 839
7368a6c8 840void
841channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
842{
843 channel_handle_rfd(c, readset, writeset);
844 channel_handle_wfd(c, readset, writeset);
845}
aa3378df 846
7e7327a1 847void
848channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
849{
850 channel_handle_rfd(c, readset, writeset);
851 channel_handle_wfd(c, readset, writeset);
852 channel_handle_efd(c, readset, writeset);
853 channel_check_window(c, readset, writeset);
854}
855
7368a6c8 856void
857channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
858{
859 int len;
860 /* Send buffered output data to the socket. */
861 if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
862 len = write(c->sock, buffer_ptr(&c->output),
863 buffer_len(&c->output));
864 if (len <= 0)
865 buffer_consume(&c->output, buffer_len(&c->output));
866 else
867 buffer_consume(&c->output, len);
868 }
869}
5260325f 870
7e7327a1 871void
872channel_handler_init_20(void)
873{
874 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;
0b242b12 875 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
7e7327a1 876 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
fa08c86b 877 channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener;
0b242b12 878 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
fa08c86b 879 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
97fb6912 880 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
7e7327a1 881
882 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2;
883 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
fa08c86b 884 channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener;
0b242b12 885 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
fa08c86b 886 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
97fb6912 887 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
7e7327a1 888}
889
7368a6c8 890void
891channel_handler_init_13(void)
892{
893 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;
894 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13;
895 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
896 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
897 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
898 channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining;
899 channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining;
97fb6912 900 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
7368a6c8 901
902 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
903 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
904 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
905 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
906 channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13;
97fb6912 907 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
7368a6c8 908}
5260325f 909
7368a6c8 910void
911channel_handler_init_15(void)
912{
913 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;
0b242b12 914 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
7368a6c8 915 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
916 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
917 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
97fb6912 918 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
7368a6c8 919
920 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
921 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
922 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
923 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
97fb6912 924 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
7368a6c8 925}
926
927void
928channel_handler_init(void)
929{
930 int i;
931 for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
932 channel_pre[i] = NULL;
933 channel_post[i] = NULL;
934 }
7e7327a1 935 if (compat20)
936 channel_handler_init_20();
937 else if (compat13)
7368a6c8 938 channel_handler_init_13();
939 else
940 channel_handler_init_15();
941}
942
6ae2364d 943void
7368a6c8 944channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
945{
946 static int did_init = 0;
947 int i;
948 Channel *c;
949
950 if (!did_init) {
951 channel_handler_init();
952 did_init = 1;
953 }
954 for (i = 0; i < channels_alloc; i++) {
955 c = &channels[i];
956 if (c->type == SSH_CHANNEL_FREE)
5260325f 957 continue;
7368a6c8 958 if (ftab[c->type] == NULL)
959 continue;
960 (*ftab[c->type])(c, readset, writeset);
7e7327a1 961 chan_delete_if_full_closed(c);
8efc0c15 962 }
8efc0c15 963}
964
6ae2364d 965void
39929cdb 966channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp)
7368a6c8 967{
39929cdb 968 int n;
969 u_int sz;
970
971 n = MAX(*maxfdp, channel_max_fd);
972
973 sz = howmany(n+1, NFDBITS) * sizeof(fd_mask);
974 if (*readsetp == NULL || n > *maxfdp) {
975 if (*readsetp)
976 xfree(*readsetp);
977 if (*writesetp)
978 xfree(*writesetp);
979 *readsetp = xmalloc(sz);
980 *writesetp = xmalloc(sz);
981 *maxfdp = n;
982 }
983 memset(*readsetp, 0, sz);
984 memset(*writesetp, 0, sz);
985
986 channel_handler(channel_pre, *readsetp, *writesetp);
7368a6c8 987}
988
6ae2364d 989void
7368a6c8 990channel_after_select(fd_set * readset, fd_set * writeset)
991{
992 channel_handler(channel_post, readset, writeset);
993}
994
39929cdb 995/* If there is data to send to the connection, enqueue some of it now. */
8efc0c15 996
6ae2364d 997void
5260325f 998channel_output_poll()
8efc0c15 999{
5260325f 1000 int len, i;
7368a6c8 1001 Channel *c;
5260325f 1002
1003 for (i = 0; i < channels_alloc; i++) {
7368a6c8 1004 c = &channels[i];
48e671d5 1005
aa3378df 1006 /* We are only interested in channels that can have buffered incoming data. */
48e671d5 1007 if (compat13) {
7368a6c8 1008 if (c->type != SSH_CHANNEL_OPEN &&
1009 c->type != SSH_CHANNEL_INPUT_DRAINING)
48e671d5 1010 continue;
1011 } else {
7368a6c8 1012 if (c->type != SSH_CHANNEL_OPEN)
48e671d5 1013 continue;
7368a6c8 1014 if (c->istate != CHAN_INPUT_OPEN &&
1015 c->istate != CHAN_INPUT_WAIT_DRAIN)
48e671d5 1016 continue;
1017 }
e78a59f5 1018 if (compat20 &&
1019 (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
7e7327a1 1020 debug("channel: %d: no data after CLOSE", c->self);
1021 continue;
1022 }
5260325f 1023
1024 /* Get the amount of buffered data for this channel. */
7368a6c8 1025 len = buffer_len(&c->input);
5260325f 1026 if (len > 0) {
aa3378df 1027 /* Send some data for the other side over the secure connection. */
7e7327a1 1028 if (compat20) {
1029 if (len > c->remote_window)
1030 len = c->remote_window;
1031 if (len > c->remote_maxpacket)
1032 len = c->remote_maxpacket;
5260325f 1033 } else {
7e7327a1 1034 if (packet_is_interactive()) {
1035 if (len > 1024)
1036 len = 512;
1037 } else {
1038 /* Keep the packets at reasonable size. */
1039 if (len > packet_get_maxsize()/2)
1040 len = packet_get_maxsize()/2;
1041 }
5260325f 1042 }
7368a6c8 1043 if (len > 0) {
7e7327a1 1044 packet_start(compat20 ?
1045 SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
7368a6c8 1046 packet_put_int(c->remote_id);
1047 packet_put_string(buffer_ptr(&c->input), len);
1048 packet_send();
1049 buffer_consume(&c->input, len);
1050 c->remote_window -= len;
7368a6c8 1051 }
1052 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
5260325f 1053 if (compat13)
1054 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
aa3378df 1055 /*
1056 * input-buffer is empty and read-socket shutdown:
1057 * tell peer, that we will not send more data: send IEOF
1058 */
7368a6c8 1059 chan_ibuf_empty(c);
5260325f 1060 }
7e7327a1 1061 /* Send extended data, i.e. stderr */
1062 if (compat20 &&
1063 c->remote_window > 0 &&
1064 (len = buffer_len(&c->extended)) > 0 &&
1065 c->extended_usage == CHAN_EXTENDED_READ) {
1066 if (len > c->remote_window)
1067 len = c->remote_window;
1068 if (len > c->remote_maxpacket)
1069 len = c->remote_maxpacket;
1070 packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
1071 packet_put_int(c->remote_id);
1072 packet_put_int(SSH2_EXTENDED_DATA_STDERR);
1073 packet_put_string(buffer_ptr(&c->extended), len);
1074 packet_send();
1075 buffer_consume(&c->extended, len);
1076 c->remote_window -= len;
1077 }
8efc0c15 1078 }
8efc0c15 1079}
1080
aa3378df 1081/*
1082 * This is called when a packet of type CHANNEL_DATA has just been received.
1083 * The message type has already been consumed, but channel number and data is
1084 * still there.
1085 */
8efc0c15 1086
6ae2364d 1087void
188adeb2 1088channel_input_data(int type, int plen, void *ctxt)
8efc0c15 1089{
48e671d5 1090 int id;
5260325f 1091 char *data;
1e3b8b07 1092 u_int data_len;
7368a6c8 1093 Channel *c;
5260325f 1094
1095 /* Get the channel number and verify it. */
48e671d5 1096 id = packet_get_int();
7368a6c8 1097 c = channel_lookup(id);
1098 if (c == NULL)
48e671d5 1099 packet_disconnect("Received data for nonexistent channel %d.", id);
5260325f 1100
1101 /* Ignore any data for non-open channels (might happen on close) */
7368a6c8 1102 if (c->type != SSH_CHANNEL_OPEN &&
1103 c->type != SSH_CHANNEL_X11_OPEN)
48e671d5 1104 return;
1105
1106 /* same for protocol 1.5 if output end is no longer open */
7368a6c8 1107 if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
5260325f 1108 return;
1109
1110 /* Get the data. */
1111 data = packet_get_string(&data_len);
6ae2364d 1112 packet_done();
7368a6c8 1113
7e7327a1 1114 if (compat20){
1115 if (data_len > c->local_maxpacket) {
1116 log("channel %d: rcvd big packet %d, maxpack %d",
1117 c->self, data_len, c->local_maxpacket);
1118 }
1119 if (data_len > c->local_window) {
1120 log("channel %d: rcvd too much data %d, win %d",
1121 c->self, data_len, c->local_window);
1122 xfree(data);
1123 return;
1124 }
1125 c->local_window -= data_len;
1126 }else{
1127 packet_integrity_check(plen, 4 + 4 + data_len, type);
1128 }
7368a6c8 1129 buffer_append(&c->output, data, data_len);
5260325f 1130 xfree(data);
8efc0c15 1131}
6ae2364d 1132void
188adeb2 1133channel_input_extended_data(int type, int plen, void *ctxt)
7e7327a1 1134{
1135 int id;
1136 int tcode;
1137 char *data;
1e3b8b07 1138 u_int data_len;
7e7327a1 1139 Channel *c;
1140
1141 /* Get the channel number and verify it. */
1142 id = packet_get_int();
1143 c = channel_lookup(id);
1144
1145 if (c == NULL)
1146 packet_disconnect("Received extended_data for bad channel %d.", id);
1147 if (c->type != SSH_CHANNEL_OPEN) {
1148 log("channel %d: ext data for non open", id);
1149 return;
1150 }
1151 tcode = packet_get_int();
1152 if (c->efd == -1 ||
1153 c->extended_usage != CHAN_EXTENDED_WRITE ||
1154 tcode != SSH2_EXTENDED_DATA_STDERR) {
1155 log("channel %d: bad ext data", c->self);
1156 return;
1157 }
1158 data = packet_get_string(&data_len);
6ae2364d 1159 packet_done();
7e7327a1 1160 if (data_len > c->local_window) {
1161 log("channel %d: rcvd too much extended_data %d, win %d",
1162 c->self, data_len, c->local_window);
1163 xfree(data);
1164 return;
1165 }
de273eef 1166 debug2("channel %d: rcvd ext data %d", c->self, data_len);
7e7327a1 1167 c->local_window -= data_len;
1168 buffer_append(&c->extended, data, data_len);
1169 xfree(data);
1170}
1171
8efc0c15 1172
aa3378df 1173/*
1174 * Returns true if no channel has too much buffered data, and false if one or
1175 * more channel is overfull.
1176 */
8efc0c15 1177
6ae2364d 1178int
5260325f 1179channel_not_very_much_buffered_data()
8efc0c15 1180{
1e3b8b07 1181 u_int i;
7368a6c8 1182 Channel *c;
5260325f 1183
1184 for (i = 0; i < channels_alloc; i++) {
7368a6c8 1185 c = &channels[i];
1186 if (c->type == SSH_CHANNEL_OPEN) {
7e7327a1 1187 if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
7368a6c8 1188 debug("channel %d: big input buffer %d",
1189 c->self, buffer_len(&c->input));
5260325f 1190 return 0;
7368a6c8 1191 }
1192 if (buffer_len(&c->output) > packet_get_maxsize()) {
1193 debug("channel %d: big output buffer %d",
1194 c->self, buffer_len(&c->output));
5260325f 1195 return 0;
7368a6c8 1196 }
5260325f 1197 }
8efc0c15 1198 }
5260325f 1199 return 1;
8efc0c15 1200}
1201
6ae2364d 1202void
188adeb2 1203channel_input_ieof(int type, int plen, void *ctxt)
7368a6c8 1204{
1205 int id;
1206 Channel *c;
1207
1208 packet_integrity_check(plen, 4, type);
1209
1210 id = packet_get_int();
1211 c = channel_lookup(id);
1212 if (c == NULL)
1213 packet_disconnect("Received ieof for nonexistent channel %d.", id);
1214 chan_rcvd_ieof(c);
1215}
8efc0c15 1216
6ae2364d 1217void
188adeb2 1218channel_input_close(int type, int plen, void *ctxt)
8efc0c15 1219{
7368a6c8 1220 int id;
1221 Channel *c;
5260325f 1222
7368a6c8 1223 packet_integrity_check(plen, 4, type);
1224
1225 id = packet_get_int();
1226 c = channel_lookup(id);
1227 if (c == NULL)
1228 packet_disconnect("Received close for nonexistent channel %d.", id);
aa3378df 1229
1230 /*
1231 * Send a confirmation that we have closed the channel and no more
1232 * data is coming for it.
1233 */
5260325f 1234 packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
7368a6c8 1235 packet_put_int(c->remote_id);
5260325f 1236 packet_send();
1237
aa3378df 1238 /*
1239 * If the channel is in closed state, we have sent a close request,
1240 * and the other side will eventually respond with a confirmation.
1241 * Thus, we cannot free the channel here, because then there would be
1242 * no-one to receive the confirmation. The channel gets freed when
1243 * the confirmation arrives.
1244 */
7368a6c8 1245 if (c->type != SSH_CHANNEL_CLOSED) {
aa3378df 1246 /*
1247 * Not a closed channel - mark it as draining, which will
1248 * cause it to be freed later.
1249 */
7368a6c8 1250 buffer_consume(&c->input, buffer_len(&c->input));
1251 c->type = SSH_CHANNEL_OUTPUT_DRAINING;
5260325f 1252 }
8efc0c15 1253}
1254
7368a6c8 1255/* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
6ae2364d 1256void
188adeb2 1257channel_input_oclose(int type, int plen, void *ctxt)
8efc0c15 1258{
7368a6c8 1259 int id = packet_get_int();
1260 Channel *c = channel_lookup(id);
1261 packet_integrity_check(plen, 4, type);
1262 if (c == NULL)
1263 packet_disconnect("Received oclose for nonexistent channel %d.", id);
1264 chan_rcvd_oclose(c);
8efc0c15 1265}
1266
6ae2364d 1267void
188adeb2 1268channel_input_close_confirmation(int type, int plen, void *ctxt)
7368a6c8 1269{
1270 int id = packet_get_int();
1271 Channel *c = channel_lookup(id);
1272
6ae2364d 1273 packet_done();
7368a6c8 1274 if (c == NULL)
1275 packet_disconnect("Received close confirmation for "
1276 "out-of-range channel %d.", id);
1277 if (c->type != SSH_CHANNEL_CLOSED)
1278 packet_disconnect("Received close confirmation for "
1279 "non-closed channel %d (type %d).", id, c->type);
1280 channel_free(c->self);
1281}
8efc0c15 1282
6ae2364d 1283void
188adeb2 1284channel_input_open_confirmation(int type, int plen, void *ctxt)
8efc0c15 1285{
7368a6c8 1286 int id, remote_id;
1287 Channel *c;
5260325f 1288
7e7327a1 1289 if (!compat20)
1290 packet_integrity_check(plen, 4 + 4, type);
5260325f 1291
7368a6c8 1292 id = packet_get_int();
1293 c = channel_lookup(id);
5260325f 1294
7368a6c8 1295 if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1296 packet_disconnect("Received open confirmation for "
1297 "non-opening channel %d.", id);
1298 remote_id = packet_get_int();
aa3378df 1299 /* Record the remote channel number and mark that the channel is now open. */
7368a6c8 1300 c->remote_id = remote_id;
1301 c->type = SSH_CHANNEL_OPEN;
7e7327a1 1302
1303 if (compat20) {
1304 c->remote_window = packet_get_int();
1305 c->remote_maxpacket = packet_get_int();
6ae2364d 1306 packet_done();
7e7327a1 1307 if (c->cb_fn != NULL && c->cb_event == type) {
de273eef 1308 debug2("callback start");
7e7327a1 1309 c->cb_fn(c->self, c->cb_arg);
de273eef 1310 debug2("callback done");
7e7327a1 1311 }
1312 debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1313 c->remote_window, c->remote_maxpacket);
1314 }
8efc0c15 1315}
1316
6ae2364d 1317void
188adeb2 1318channel_input_open_failure(int type, int plen, void *ctxt)
8efc0c15 1319{
7368a6c8 1320 int id;
1321 Channel *c;
5260325f 1322
7e7327a1 1323 if (!compat20)
1324 packet_integrity_check(plen, 4, type);
7368a6c8 1325
1326 id = packet_get_int();
1327 c = channel_lookup(id);
1328
1329 if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1330 packet_disconnect("Received open failure for "
1331 "non-opening channel %d.", id);
7e7327a1 1332 if (compat20) {
1333 int reason = packet_get_int();
1334 char *msg = packet_get_string(NULL);
6ae2364d 1335 char *lang = packet_get_string(NULL);
7e7327a1 1336 log("channel_open_failure: %d: reason %d: %s", id, reason, msg);
6ae2364d 1337 packet_done();
7e7327a1 1338 xfree(msg);
6ae2364d 1339 xfree(lang);
7e7327a1 1340 }
5260325f 1341 /* Free the channel. This will also close the socket. */
7368a6c8 1342 channel_free(id);
8efc0c15 1343}
1344
7e7327a1 1345void
188adeb2 1346channel_input_channel_request(int type, int plen, void *ctxt)
7e7327a1 1347{
1348 int id;
1349 Channel *c;
1350
1351 id = packet_get_int();
1352 c = channel_lookup(id);
1353
1354 if (c == NULL ||
1355 (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1356 packet_disconnect("Received request for "
1357 "non-open channel %d.", id);
1358 if (c->cb_fn != NULL && c->cb_event == type) {
de273eef 1359 debug2("callback start");
7e7327a1 1360 c->cb_fn(c->self, c->cb_arg);
de273eef 1361 debug2("callback done");
7e7327a1 1362 } else {
1363 char *service = packet_get_string(NULL);
1364 debug("channel: %d rcvd request for %s", c->self, service);
de273eef 1365 debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
7e7327a1 1366 xfree(service);
1367 }
1368}
1369
6ae2364d 1370void
188adeb2 1371channel_input_window_adjust(int type, int plen, void *ctxt)
7e7327a1 1372{
1373 Channel *c;
1374 int id, adjust;
1375
1376 if (!compat20)
1377 return;
1378
1379 /* Get the channel number and verify it. */
1380 id = packet_get_int();
1381 c = channel_lookup(id);
1382
1383 if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1384 log("Received window adjust for "
1385 "non-open channel %d.", id);
1386 return;
1387 }
1388 adjust = packet_get_int();
6ae2364d 1389 packet_done();
de273eef 1390 debug2("channel %d: rcvd adjust %d", id, adjust);
7e7327a1 1391 c->remote_window += adjust;
1392}
1393
aa3378df 1394/*
1395 * Stops listening for channels, and removes any unix domain sockets that we
1396 * might have.
1397 */
8efc0c15 1398
6ae2364d 1399void
5260325f 1400channel_stop_listening()
8efc0c15 1401{
5260325f 1402 int i;
1403 for (i = 0; i < channels_alloc; i++) {
1404 switch (channels[i].type) {
1405 case SSH_CHANNEL_AUTH_SOCKET:
1406 close(channels[i].sock);
77bb0bca 1407 unlink(channels[i].path);
5260325f 1408 channel_free(i);
1409 break;
1410 case SSH_CHANNEL_PORT_LISTENER:
fa08c86b 1411 case SSH_CHANNEL_RPORT_LISTENER:
5260325f 1412 case SSH_CHANNEL_X11_LISTENER:
1413 close(channels[i].sock);
1414 channel_free(i);
1415 break;
1416 default:
1417 break;
1418 }
8efc0c15 1419 }
8efc0c15 1420}
1421
aa3378df 1422/*
0fbe8c74 1423 * Closes the sockets/fds of all channels. This is used to close extra file
aa3378df 1424 * descriptors after a fork.
1425 */
8efc0c15 1426
6ae2364d 1427void
5260325f 1428channel_close_all()
8efc0c15 1429{
5260325f 1430 int i;
0fbe8c74 1431 for (i = 0; i < channels_alloc; i++)
5260325f 1432 if (channels[i].type != SSH_CHANNEL_FREE)
0fbe8c74 1433 channel_close_fds(&channels[i]);
8efc0c15 1434}
1435
8efc0c15 1436/* Returns true if any channel is still open. */
1437
6ae2364d 1438int
5260325f 1439channel_still_open()
8efc0c15 1440{
1e3b8b07 1441 u_int i;
5260325f 1442 for (i = 0; i < channels_alloc; i++)
1443 switch (channels[i].type) {
1444 case SSH_CHANNEL_FREE:
1445 case SSH_CHANNEL_X11_LISTENER:
1446 case SSH_CHANNEL_PORT_LISTENER:
fa08c86b 1447 case SSH_CHANNEL_RPORT_LISTENER:
5260325f 1448 case SSH_CHANNEL_CLOSED:
1449 case SSH_CHANNEL_AUTH_SOCKET:
97fb6912 1450 case SSH_CHANNEL_CONNECTING: /* XXX ??? */
5260325f 1451 continue;
7e7327a1 1452 case SSH_CHANNEL_LARVAL:
1453 if (!compat20)
1454 fatal("cannot happen: SSH_CHANNEL_LARVAL");
1455 continue;
5260325f 1456 case SSH_CHANNEL_OPENING:
1457 case SSH_CHANNEL_OPEN:
1458 case SSH_CHANNEL_X11_OPEN:
1459 return 1;
1460 case SSH_CHANNEL_INPUT_DRAINING:
1461 case SSH_CHANNEL_OUTPUT_DRAINING:
1462 if (!compat13)
1463 fatal("cannot happen: OUT_DRAIN");
1464 return 1;
1465 default:
1466 fatal("channel_still_open: bad channel type %d", channels[i].type);
1467 /* NOTREACHED */
1468 }
1469 return 0;
8efc0c15 1470}
1471
aa3378df 1472/*
1473 * Returns a message describing the currently open forwarded connections,
1474 * suitable for sending to the client. The message contains crlf pairs for
1475 * newlines.
1476 */
8efc0c15 1477
5260325f 1478char *
1479channel_open_message()
8efc0c15 1480{
5260325f 1481 Buffer buffer;
1482 int i;
1483 char buf[512], *cp;
1484
1485 buffer_init(&buffer);
1486 snprintf(buf, sizeof buf, "The following connections are open:\r\n");
8efc0c15 1487 buffer_append(&buffer, buf, strlen(buf));
5260325f 1488 for (i = 0; i < channels_alloc; i++) {
1489 Channel *c = &channels[i];
1490 switch (c->type) {
1491 case SSH_CHANNEL_FREE:
1492 case SSH_CHANNEL_X11_LISTENER:
1493 case SSH_CHANNEL_PORT_LISTENER:
fa08c86b 1494 case SSH_CHANNEL_RPORT_LISTENER:
5260325f 1495 case SSH_CHANNEL_CLOSED:
1496 case SSH_CHANNEL_AUTH_SOCKET:
1497 continue;
7e7327a1 1498 case SSH_CHANNEL_LARVAL:
5260325f 1499 case SSH_CHANNEL_OPENING:
97fb6912 1500 case SSH_CHANNEL_CONNECTING:
5260325f 1501 case SSH_CHANNEL_OPEN:
1502 case SSH_CHANNEL_X11_OPEN:
1503 case SSH_CHANNEL_INPUT_DRAINING:
1504 case SSH_CHANNEL_OUTPUT_DRAINING:
7368a6c8 1505 snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
48e671d5 1506 c->self, c->remote_name,
1507 c->type, c->remote_id,
1508 c->istate, buffer_len(&c->input),
7368a6c8 1509 c->ostate, buffer_len(&c->output),
1510 c->rfd, c->wfd);
5260325f 1511 buffer_append(&buffer, buf, strlen(buf));
1512 continue;
1513 default:
7368a6c8 1514 fatal("channel_open_message: bad channel type %d", c->type);
5260325f 1515 /* NOTREACHED */
1516 }
1517 }
1518 buffer_append(&buffer, "\0", 1);
1519 cp = xstrdup(buffer_ptr(&buffer));
1520 buffer_free(&buffer);
1521 return cp;
8efc0c15 1522}
1523
aa3378df 1524/*
1525 * Initiate forwarding of connections to local port "port" through the secure
1526 * channel to host:port from remote side.
1527 */
fa08c86b 1528void
1529channel_request_local_forwarding(u_short listen_port, const char *host_to_connect,
1530 u_short port_to_connect, int gateway_ports)
1531{
1532 channel_request_forwarding(
1533 NULL, listen_port,
1534 host_to_connect, port_to_connect,
1535 gateway_ports, /*remote_fwd*/ 0);
1536}
8efc0c15 1537
fa08c86b 1538/*
1539 * If 'remote_fwd' is true we have a '-R style' listener for protocol 2
1540 * (SSH_CHANNEL_RPORT_LISTENER).
1541 */
6ae2364d 1542void
fa08c86b 1543channel_request_forwarding(
1544 const char *listen_address, u_short listen_port,
1545 const char *host_to_connect, u_short port_to_connect,
1546 int gateway_ports, int remote_fwd)
8efc0c15 1547{
fa08c86b 1548 int success, ch, sock, on = 1, ctype;
48e671d5 1549 struct addrinfo hints, *ai, *aitop;
1550 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
fa08c86b 1551 const char *host;
aa3378df 1552 struct linger linger;
5260325f 1553
fa08c86b 1554 if (remote_fwd) {
1555 host = listen_address;
1556 ctype = SSH_CHANNEL_RPORT_LISTENER;
1557 } else {
1558 host = host_to_connect;
1559 ctype =SSH_CHANNEL_PORT_LISTENER;
1560 }
1561
5260325f 1562 if (strlen(host) > sizeof(channels[0].path) - 1)
1563 packet_disconnect("Forward host name too long.");
1564
fa08c86b 1565 /* XXX listen_address is currently ignored */
aa3378df 1566 /*
48e671d5 1567 * getaddrinfo returns a loopback address if the hostname is
1568 * set to NULL and hints.ai_flags is not AI_PASSIVE
aa3378df 1569 */
48e671d5 1570 memset(&hints, 0, sizeof(hints));
1571 hints.ai_family = IPv4or6;
1572 hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1573 hints.ai_socktype = SOCK_STREAM;
fa08c86b 1574 snprintf(strport, sizeof strport, "%d", listen_port);
48e671d5 1575 if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1576 packet_disconnect("getaddrinfo: fatal error");
1577
1578 success = 0;
1579 for (ai = aitop; ai; ai = ai->ai_next) {
1580 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1581 continue;
1582 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1583 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
fa08c86b 1584 error("channel_request_forwarding: getnameinfo failed");
48e671d5 1585 continue;
1586 }
1587 /* Create a port to listen for the host. */
1588 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1589 if (sock < 0) {
1590 /* this is no error since kernel may not support ipv6 */
1591 verbose("socket: %.100s", strerror(errno));
1592 continue;
1593 }
1594 /*
1595 * Set socket options. We would like the socket to disappear
1596 * as soon as it has been closed for whatever reason.
1597 */
1598 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1599 linger.l_onoff = 1;
1600 linger.l_linger = 5;
1601 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1602 debug("Local forwarding listening on %s port %s.", ntop, strport);
1603
1604 /* Bind the socket to the address. */
1605 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1606 /* address can be in use ipv6 address is already bound */
16218745 1607 if (!ai->ai_next)
1608 error("bind: %.100s", strerror(errno));
1609 else
1610 verbose("bind: %.100s", strerror(errno));
1611
48e671d5 1612 close(sock);
1613 continue;
1614 }
1615 /* Start listening for connections on the socket. */
1616 if (listen(sock, 5) < 0) {
1617 error("listen: %.100s", strerror(errno));
1618 close(sock);
1619 continue;
1620 }
1621 /* Allocate a channel number for the socket. */
fa08c86b 1622 ch = channel_new("port listener", ctype, sock, sock, -1,
0b242b12 1623 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
a22aff1f 1624 0, xstrdup("port listener"), 1);
48e671d5 1625 strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
fa08c86b 1626 channels[ch].host_port = port_to_connect;
1627 channels[ch].listening_port = listen_port;
48e671d5 1628 success = 1;
1629 }
1630 if (success == 0)
fa08c86b 1631 packet_disconnect("cannot listen port: %d", listen_port); /*XXX ?disconnect? */
48e671d5 1632 freeaddrinfo(aitop);
5260325f 1633}
8efc0c15 1634
aa3378df 1635/*
1636 * Initiate forwarding of connections to port "port" on remote host through
1637 * the secure channel to host:port from local side.
1638 */
8efc0c15 1639
6ae2364d 1640void
fa08c86b 1641channel_request_remote_forwarding(u_short listen_port,
1642 const char *host_to_connect, u_short port_to_connect)
8efc0c15 1643{
fa08c86b 1644 int payload_len, type, success = 0;
1645
5260325f 1646 /* Record locally that connection to this host/port is permitted. */
1647 if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1648 fatal("channel_request_remote_forwarding: too many forwards");
1649
5260325f 1650 /* Send the forward request to the remote side. */
7e7327a1 1651 if (compat20) {
1652 const char *address_to_bind = "0.0.0.0";
1653 packet_start(SSH2_MSG_GLOBAL_REQUEST);
1654 packet_put_cstring("tcpip-forward");
1655 packet_put_char(0); /* boolean: want reply */
1656 packet_put_cstring(address_to_bind);
1657 packet_put_int(listen_port);
fa08c86b 1658 packet_send();
1659 packet_write_wait();
1660 /* Assume that server accepts the request */
1661 success = 1;
7e7327a1 1662 } else {
1663 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
7e7327a1 1664 packet_put_int(listen_port);
d6f24e45 1665 packet_put_cstring(host_to_connect);
1666 packet_put_int(port_to_connect);
7e7327a1 1667 packet_send();
1668 packet_write_wait();
fa08c86b 1669
1670 /* Wait for response from the remote side. */
1671 type = packet_read(&payload_len);
1672 switch (type) {
1673 case SSH_SMSG_SUCCESS:
1674 success = 1;
1675 break;
1676 case SSH_SMSG_FAILURE:
1677 log("Warning: Server denied remote port forwarding.");
1678 break;
1679 default:
1680 /* Unknown packet */
1681 packet_disconnect("Protocol error for port forward request:"
1682 "received packet type %d.", type);
1683 }
1684 }
1685 if (success) {
1686 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1687 permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1688 permitted_opens[num_permitted_opens].listen_port = listen_port;
1689 num_permitted_opens++;
7e7327a1 1690 }
8efc0c15 1691}
1692
aa3378df 1693/*
1694 * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
1695 * listening for the port, and sends back a success reply (or disconnect
1696 * message if there was an error). This never returns if there was an error.
1697 */
8efc0c15 1698
6ae2364d 1699void
1d1ffb87 1700channel_input_port_forward_request(int is_root, int gateway_ports)
8efc0c15 1701{
57112b5a 1702 u_short port, host_port;
5260325f 1703 char *hostname;
1704
1705 /* Get arguments from the packet. */
1706 port = packet_get_int();
1707 hostname = packet_get_string(NULL);
1708 host_port = packet_get_int();
1709
3c62e7eb 1710#ifndef HAVE_CYGWIN
aa3378df 1711 /*
1712 * Check that an unprivileged user is not trying to forward a
1713 * privileged port.
1714 */
5260325f 1715 if (port < IPPORT_RESERVED && !is_root)
1716 packet_disconnect("Requested forwarding of port %d but user is not root.",
1717 port);
3c62e7eb 1718#endif
fa08c86b 1719 /* Initiate forwarding */
1d1ffb87 1720 channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
5260325f 1721
1722 /* Free the argument string. */
1723 xfree(hostname);
8efc0c15 1724}
1725
7368a6c8 1726/* XXX move to aux.c */
1727int
1728channel_connect_to(const char *host, u_short host_port)
8efc0c15 1729{
48e671d5 1730 struct addrinfo hints, *ai, *aitop;
1731 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1732 int gaierr;
7368a6c8 1733 int sock = -1;
48e671d5 1734
1735 memset(&hints, 0, sizeof(hints));
1736 hints.ai_family = IPv4or6;
1737 hints.ai_socktype = SOCK_STREAM;
1738 snprintf(strport, sizeof strport, "%d", host_port);
1739 if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1740 error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
7368a6c8 1741 return -1;
48e671d5 1742 }
48e671d5 1743 for (ai = aitop; ai; ai = ai->ai_next) {
1744 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1745 continue;
1746 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1747 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
7368a6c8 1748 error("channel_connect_to: getnameinfo failed");
48e671d5 1749 continue;
5260325f 1750 }
48e671d5 1751 /* Create the socket. */
1752 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1753 if (sock < 0) {
1754 error("socket: %.100s", strerror(errno));
1755 continue;
5260325f 1756 }
eea39c02 1757 if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
97fb6912 1758 fatal("connect_to: F_SETFL: %s", strerror(errno));
48e671d5 1759 /* Connect to the host/port. */
97fb6912 1760 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 &&
1761 errno != EINPROGRESS) {
48e671d5 1762 error("connect %.100s port %s: %.100s", ntop, strport,
1763 strerror(errno));
1764 close(sock);
1765 continue; /* fail -- try next */
1766 }
1767 break; /* success */
5260325f 1768
5260325f 1769 }
48e671d5 1770 freeaddrinfo(aitop);
48e671d5 1771 if (!ai) {
1772 error("connect %.100s port %d: failed.", host, host_port);
7368a6c8 1773 return -1;
8efc0c15 1774 }
7368a6c8 1775 /* success */
1776 return sock;
1777}
fa08c86b 1778int
1779channel_connect_by_listen_adress(u_short listen_port)
1780{
1781 int i;
1782 for (i = 0; i < num_permitted_opens; i++)
1783 if (permitted_opens[i].listen_port == listen_port)
1784 return channel_connect_to(
1785 permitted_opens[i].host_to_connect,
1786 permitted_opens[i].port_to_connect);
0b6fbf03 1787 error("WARNING: Server requests forwarding for unknown listen_port %d",
1788 listen_port);
fa08c86b 1789 return -1;
1790}
48e671d5 1791
7368a6c8 1792/*
1793 * This is called after receiving PORT_OPEN message. This attempts to
1794 * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1795 * or CHANNEL_OPEN_FAILURE.
1796 */
5260325f 1797
6ae2364d 1798void
188adeb2 1799channel_input_port_open(int type, int plen, void *ctxt)
7368a6c8 1800{
1801 u_short host_port;
1802 char *host, *originator_string;
1803 int remote_channel, sock = -1, newch, i, denied;
1e3b8b07 1804 u_int host_len, originator_len;
5260325f 1805
7368a6c8 1806 /* Get remote channel number. */
1807 remote_channel = packet_get_int();
5260325f 1808
7368a6c8 1809 /* Get host name to connect to. */
1810 host = packet_get_string(&host_len);
5260325f 1811
7368a6c8 1812 /* Get port to connect to. */
1813 host_port = packet_get_int();
5260325f 1814
7368a6c8 1815 /* Get remote originator name. */
1816 if (have_hostname_in_open) {
1817 originator_string = packet_get_string(&originator_len);
1818 originator_len += 4; /* size of packet_int */
1819 } else {
1820 originator_string = xstrdup("unknown (remote did not supply name)");
1821 originator_len = 0; /* no originator supplied */
1822 }
5260325f 1823
7368a6c8 1824 packet_integrity_check(plen,
1825 4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1826
1827 /* Check if opening that port is permitted. */
1828 denied = 0;
1829 if (!all_opens_permitted) {
1830 /* Go trough all permitted ports. */
1831 for (i = 0; i < num_permitted_opens; i++)
1832 if (permitted_opens[i].port_to_connect == host_port &&
1833 strcmp(permitted_opens[i].host_to_connect, host) == 0)
1834 break;
1835
1836 /* Check if we found the requested port among those permitted. */
1837 if (i >= num_permitted_opens) {
1838 /* The port is not permitted. */
1839 log("Received request to connect to %.100s:%d, but the request was denied.",
1840 host, host_port);
1841 denied = 1;
1842 }
1843 }
1844 sock = denied ? -1 : channel_connect_to(host, host_port);
1845 if (sock > 0) {
1846 /* Allocate a channel for this connection. */
97fb6912 1847 newch = channel_allocate(SSH_CHANNEL_CONNECTING,
1848 sock, originator_string);
1849/*XXX delay answer? */
7368a6c8 1850 channels[newch].remote_id = remote_channel;
1851
1852 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1853 packet_put_int(remote_channel);
1854 packet_put_int(newch);
1855 packet_send();
1856 } else {
1857 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1858 packet_put_int(remote_channel);
1859 packet_send();
1860 }
1861 xfree(host);
8efc0c15 1862}
1863
aa3378df 1864/*
1865 * Creates an internet domain socket for listening for X11 connections.
1866 * Returns a suitable value for the DISPLAY variable, or NULL if an error
1867 * occurs.
1868 */
8efc0c15 1869
48e671d5 1870#define NUM_SOCKS 10
1871
5260325f 1872char *
95f1eccc 1873x11_create_display_inet(int screen_number, int x11_display_offset)
8efc0c15 1874{
57112b5a 1875 int display_number, sock;
1876 u_short port;
48e671d5 1877 struct addrinfo hints, *ai, *aitop;
1878 char strport[NI_MAXSERV];
1879 int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1880 char display[512];
5260325f 1881 char hostname[MAXHOSTNAMELEN];
1882
95f1eccc 1883 for (display_number = x11_display_offset;
5260325f 1884 display_number < MAX_DISPLAYS;
1885 display_number++) {
1886 port = 6000 + display_number;
48e671d5 1887 memset(&hints, 0, sizeof(hints));
1888 hints.ai_family = IPv4or6;
1889 hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */
1890 hints.ai_socktype = SOCK_STREAM;
1891 snprintf(strport, sizeof strport, "%d", port);
1892 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1893 error("getaddrinfo: %.100s", gai_strerror(gaierr));
5260325f 1894 return NULL;
1895 }
48e671d5 1896 for (ai = aitop; ai; ai = ai->ai_next) {
1897 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1898 continue;
1899 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1900 if (sock < 0) {
4ee81249 1901 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
80a44451 1902 error("socket: %.100s", strerror(errno));
1903 return NULL;
1904 } else {
22d89d24 1905 debug("x11_create_display_inet: Socket family %d not supported",
1906 ai->ai_family);
80a44451 1907 continue;
1908 }
48e671d5 1909 }
1910 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1911 debug("bind port %d: %.100s", port, strerror(errno));
1912 shutdown(sock, SHUT_RDWR);
1913 close(sock);
16218745 1914
1915 if (ai->ai_next)
1916 continue;
1917
48e671d5 1918 for (n = 0; n < num_socks; n++) {
1919 shutdown(socks[n], SHUT_RDWR);
1920 close(socks[n]);
1921 }
1922 num_socks = 0;
1923 break;
1924 }
1925 socks[num_socks++] = sock;
80faa19f 1926#ifndef DONT_TRY_OTHER_AF
48e671d5 1927 if (num_socks == NUM_SOCKS)
1928 break;
80faa19f 1929#else
1930 break;
1931#endif
5260325f 1932 }
4ccb01d6 1933 freeaddrinfo(aitop);
48e671d5 1934 if (num_socks > 0)
1935 break;
5260325f 1936 }
1937 if (display_number >= MAX_DISPLAYS) {
1938 error("Failed to allocate internet-domain X11 display socket.");
1939 return NULL;
8efc0c15 1940 }
5260325f 1941 /* Start listening for connections on the socket. */
48e671d5 1942 for (n = 0; n < num_socks; n++) {
1943 sock = socks[n];
1944 if (listen(sock, 5) < 0) {
1945 error("listen: %.100s", strerror(errno));
1946 shutdown(sock, SHUT_RDWR);
1947 close(sock);
1948 return NULL;
1949 }
8efc0c15 1950 }
48e671d5 1951
5260325f 1952 /* Set up a suitable value for the DISPLAY variable. */
1953 if (gethostname(hostname, sizeof(hostname)) < 0)
1954 fatal("gethostname: %.100s", strerror(errno));
a7effaac 1955
1956#ifdef IPADDR_IN_DISPLAY
1957 /*
1958 * HPUX detects the local hostname in the DISPLAY variable and tries
1959 * to set up a shared memory connection to the server, which it
1960 * incorrectly supposes to be local.
1961 *
1962 * The workaround - as used in later $$H and other programs - is
1963 * is to set display to the host's IP address.
1964 */
1965 {
1966 struct hostent *he;
1967 struct in_addr my_addr;
1968
1969 he = gethostbyname(hostname);
1970 if (he == NULL) {
1971 error("[X11-broken-fwd-hostname-workaround] Could not get "
1972 "IP address for hostname %s.", hostname);
1973
1974 packet_send_debug("[X11-broken-fwd-hostname-workaround]"
1975 "Could not get IP address for hostname %s.", hostname);
1976
1977 shutdown(sock, SHUT_RDWR);
1978 close(sock);
1979
1980 return NULL;
1981 }
1982
1983 memcpy(&my_addr, he->h_addr_list[0], sizeof(struct in_addr));
1984
1985 /* Set DISPLAY to <ip address>:screen.display */
48e671d5 1986 snprintf(display, sizeof(display), "%.50s:%d.%d", inet_ntoa(my_addr),
74141647 1987 display_number, screen_number);
a7effaac 1988 }
1989#else /* IPADDR_IN_DISPLAY */
1990 /* Just set DISPLAY to hostname:screen.display */
48e671d5 1991 snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
74141647 1992 display_number, screen_number);
a7effaac 1993#endif /* IPADDR_IN_DISPLAY */
5260325f 1994
48e671d5 1995 /* Allocate a channel for each socket. */
1996 for (n = 0; n < num_socks; n++) {
1997 sock = socks[n];
0b242b12 1998 (void) channel_new("x11 listener",
1999 SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
2000 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
a22aff1f 2001 0, xstrdup("X11 inet listener"), 1);
48e671d5 2002 }
5260325f 2003
2004 /* Return a suitable value for the DISPLAY environment variable. */
48e671d5 2005 return xstrdup(display);
8efc0c15 2006}
2007
2008#ifndef X_UNIX_PATH
2009#define X_UNIX_PATH "/tmp/.X11-unix/X"
2010#endif
2011
2012static
2013int
1e3b8b07 2014connect_local_xsocket(u_int dnr)
8efc0c15 2015{
5260325f 2016 static const char *const x_sockets[] = {
2017 X_UNIX_PATH "%u",
2018 "/var/X/.X11-unix/X" "%u",
2019 "/usr/spool/sockets/X11/" "%u",
2020 NULL
2021 };
2022 int sock;
2023 struct sockaddr_un addr;
2024 const char *const * path;
2025
2026 for (path = x_sockets; *path; ++path) {
2027 sock = socket(AF_UNIX, SOCK_STREAM, 0);
2028 if (sock < 0)
2029 error("socket: %.100s", strerror(errno));
2030 memset(&addr, 0, sizeof(addr));
2031 addr.sun_family = AF_UNIX;
2032 snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
2033 if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
2034 return sock;
2035 close(sock);
2036 }
2037 error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
2038 return -1;
8efc0c15 2039}
2040
0b242b12 2041int
2042x11_connect_display(void)
8efc0c15 2043{
0b242b12 2044 int display_number, sock = 0;
5260325f 2045 const char *display;
0b242b12 2046 char buf[1024], *cp;
48e671d5 2047 struct addrinfo hints, *ai, *aitop;
2048 char strport[NI_MAXSERV];
2049 int gaierr;
5260325f 2050
5260325f 2051 /* Try to open a socket for the local X server. */
2052 display = getenv("DISPLAY");
2053 if (!display) {
2054 error("DISPLAY not set.");
0b242b12 2055 return -1;
5260325f 2056 }
aa3378df 2057 /*
2058 * Now we decode the value of the DISPLAY variable and make a
2059 * connection to the real X server.
2060 */
2061
2062 /*
2063 * Check if it is a unix domain socket. Unix domain displays are in
2064 * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
2065 */
5260325f 2066 if (strncmp(display, "unix:", 5) == 0 ||
2067 display[0] == ':') {
2068 /* Connect to the unix domain socket. */
2069 if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
2070 error("Could not parse display number from DISPLAY: %.100s",
2071 display);
0b242b12 2072 return -1;
5260325f 2073 }
2074 /* Create a socket. */
2075 sock = connect_local_xsocket(display_number);
2076 if (sock < 0)
0b242b12 2077 return -1;
5260325f 2078
2079 /* OK, we now have a connection to the display. */
0b242b12 2080 return sock;
5260325f 2081 }
aa3378df 2082 /*
2083 * Connect to an inet socket. The DISPLAY value is supposedly
2084 * hostname:d[.s], where hostname may also be numeric IP address.
2085 */
5260325f 2086 strncpy(buf, display, sizeof(buf));
2087 buf[sizeof(buf) - 1] = 0;
2088 cp = strchr(buf, ':');
2089 if (!cp) {
2090 error("Could not find ':' in DISPLAY: %.100s", display);
0b242b12 2091 return -1;
5260325f 2092 }
2093 *cp = 0;
aa3378df 2094 /* buf now contains the host name. But first we parse the display number. */
5260325f 2095 if (sscanf(cp + 1, "%d", &display_number) != 1) {
2096 error("Could not parse display number from DISPLAY: %.100s",
2097 display);
0b242b12 2098 return -1;
5260325f 2099 }
5260325f 2100
48e671d5 2101 /* Look up the host address */
2102 memset(&hints, 0, sizeof(hints));
2103 hints.ai_family = IPv4or6;
2104 hints.ai_socktype = SOCK_STREAM;
2105 snprintf(strport, sizeof strport, "%d", 6000 + display_number);
2106 if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
2107 error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
0b242b12 2108 return -1;
8efc0c15 2109 }
48e671d5 2110 for (ai = aitop; ai; ai = ai->ai_next) {
2111 /* Create a socket. */
2112 sock = socket(ai->ai_family, SOCK_STREAM, 0);
2113 if (sock < 0) {
2114 debug("socket: %.100s", strerror(errno));
7368a6c8 2115 continue;
2116 }
2117 /* Connect it to the display. */
2118 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2119 debug("connect %.100s port %d: %.100s", buf,
2120 6000 + display_number, strerror(errno));
2121 close(sock);
2122 continue;
2123 }
2124 /* Success */
2125 break;
48e671d5 2126 }
48e671d5 2127 freeaddrinfo(aitop);
2128 if (!ai) {
6ae2364d 2129 error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
48e671d5 2130 strerror(errno));
0b242b12 2131 return -1;
8efc0c15 2132 }
0b242b12 2133 return sock;
2134}
5260325f 2135
0b242b12 2136/*
2137 * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
2138 * the remote channel number. We should do whatever we want, and respond
2139 * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
2140 */
5260325f 2141
0b242b12 2142void
188adeb2 2143x11_input_open(int type, int plen, void *ctxt)
0b242b12 2144{
2145 int remote_channel, sock = 0, newch;
2146 char *remote_host;
1e3b8b07 2147 u_int remote_len;
5260325f 2148
0b242b12 2149 /* Get remote channel number. */
2150 remote_channel = packet_get_int();
5260325f 2151
0b242b12 2152 /* Get remote originator name. */
2153 if (have_hostname_in_open) {
2154 remote_host = packet_get_string(&remote_len);
2155 remote_len += 4;
2156 } else {
2157 remote_host = xstrdup("unknown (remote did not supply name)");
2158 remote_len = 0;
2159 }
2160
2161 debug("Received X11 open request.");
2162 packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
2163
2164 /* Obtain a connection to the real X display. */
2165 sock = x11_connect_display();
2166 if (sock == -1) {
2167 /* Send refusal to the remote host. */
2168 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2169 packet_put_int(remote_channel);
2170 packet_send();
2171 } else {
2172 /* Allocate a channel for this connection. */
2173 newch = channel_allocate(
2174 (x11_saved_proto == NULL) ?
2175 SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
2176 sock, remote_host);
2177 channels[newch].remote_id = remote_channel;
2178
2179 /* Send a confirmation to the remote host. */
2180 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2181 packet_put_int(remote_channel);
2182 packet_put_int(newch);
2183 packet_send();
2184 }
8efc0c15 2185}
2186
a22aff1f 2187/* dummy protocol handler that denies SSH-1 requests (agent/x11) */
2188void
2189deny_input_open(int type, int plen, void *ctxt)
2190{
2191 int rchan = packet_get_int();
2192 switch(type){
2193 case SSH_SMSG_AGENT_OPEN:
2194 error("Warning: ssh server tried agent forwarding.");
2195 break;
2196 case SSH_SMSG_X11_OPEN:
2197 error("Warning: ssh server tried X11 forwarding.");
2198 break;
2199 default:
2200 error("deny_input_open: type %d plen %d", type, plen);
2201 break;
2202 }
2203 error("Warning: this is probably a break in attempt by a malicious server.");
2204 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2205 packet_put_int(rchan);
2206 packet_send();
2207}
2208
aa3378df 2209/*
2210 * Requests forwarding of X11 connections, generates fake authentication
2211 * data, and enables authentication spoofing.
2212 */
8efc0c15 2213
6ae2364d 2214void
0b242b12 2215x11_request_forwarding_with_spoofing(int client_session_id,
2216 const char *proto, const char *data)
8efc0c15 2217{
1e3b8b07 2218 u_int data_len = (u_int) strlen(data) / 2;
2219 u_int i, value;
5260325f 2220 char *new_data;
2221 int screen_number;
2222 const char *cp;
2223 u_int32_t rand = 0;
2224
2225 cp = getenv("DISPLAY");
2226 if (cp)
2227 cp = strchr(cp, ':');
2228 if (cp)
2229 cp = strchr(cp, '.');
2230 if (cp)
2231 screen_number = atoi(cp + 1);
2232 else
2233 screen_number = 0;
2234
2235 /* Save protocol name. */
2236 x11_saved_proto = xstrdup(proto);
2237
aa3378df 2238 /*
2239 * Extract real authentication data and generate fake data of the
2240 * same length.
2241 */
5260325f 2242 x11_saved_data = xmalloc(data_len);
2243 x11_fake_data = xmalloc(data_len);
2244 for (i = 0; i < data_len; i++) {
2245 if (sscanf(data + 2 * i, "%2x", &value) != 1)
2246 fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2247 if (i % 4 == 0)
2248 rand = arc4random();
2249 x11_saved_data[i] = value;
2250 x11_fake_data[i] = rand & 0xff;
2251 rand >>= 8;
2252 }
2253 x11_saved_data_len = data_len;
2254 x11_fake_data_len = data_len;
2255
2256 /* Convert the fake data into hex. */
2257 new_data = xmalloc(2 * data_len + 1);
2258 for (i = 0; i < data_len; i++)
1e3b8b07 2259 sprintf(new_data + 2 * i, "%02x", (u_char) x11_fake_data[i]);
5260325f 2260
2261 /* Send the request packet. */
0b242b12 2262 if (compat20) {
2263 channel_request_start(client_session_id, "x11-req", 0);
2264 packet_put_char(0); /* XXX bool single connection */
2265 } else {
2266 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2267 }
2268 packet_put_cstring(proto);
2269 packet_put_cstring(new_data);
5260325f 2270 packet_put_int(screen_number);
2271 packet_send();
2272 packet_write_wait();
2273 xfree(new_data);
8efc0c15 2274}
2275
2276/* Sends a message to the server to request authentication fd forwarding. */
2277
6ae2364d 2278void
5260325f 2279auth_request_forwarding()
8efc0c15 2280{
5260325f 2281 packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2282 packet_send();
2283 packet_write_wait();
8efc0c15 2284}
2285
aa3378df 2286/*
2287 * Returns the name of the forwarded authentication socket. Returns NULL if
2288 * there is no forwarded authentication socket. The returned value points to
2289 * a static buffer.
2290 */
8efc0c15 2291
5260325f 2292char *
2293auth_get_socket_name()
8efc0c15 2294{
5260325f 2295 return channel_forwarded_auth_socket_name;
8efc0c15 2296}
2297
2298/* removes the agent forwarding socket */
2299
6ae2364d 2300void
5260325f 2301cleanup_socket(void)
2302{
77bb0bca 2303 unlink(channel_forwarded_auth_socket_name);
5260325f 2304 rmdir(channel_forwarded_auth_socket_dir);
8efc0c15 2305}
2306
aa3378df 2307/*
fa649821 2308 * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
aa3378df 2309 * This starts forwarding authentication requests.
2310 */
8efc0c15 2311
fa649821 2312int
5260325f 2313auth_input_request_forwarding(struct passwd * pw)
8efc0c15 2314{
5260325f 2315 int sock, newch;
2316 struct sockaddr_un sunaddr;
2317
2318 if (auth_get_socket_name() != NULL)
2319 fatal("Protocol error: authentication forwarding requested twice.");
2320
2321 /* Temporarily drop privileged uid for mkdir/bind. */
2322 temporarily_use_uid(pw->pw_uid);
2323
2324 /* Allocate a buffer for the socket name, and format the name. */
2325 channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2326 channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2327 strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2328
2329 /* Create private directory for socket */
fa649821 2330 if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
2331 packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
2332 strerror(errno));
2333 restore_uid();
2334 xfree(channel_forwarded_auth_socket_name);
2335 xfree(channel_forwarded_auth_socket_dir);
2336 channel_forwarded_auth_socket_name = NULL;
2337 channel_forwarded_auth_socket_dir = NULL;
2338 return 0;
2339 }
5260325f 2340 snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2341 channel_forwarded_auth_socket_dir, (int) getpid());
2342
2343 if (atexit(cleanup_socket) < 0) {
2344 int saved = errno;
2345 cleanup_socket();
2346 packet_disconnect("socket: %.100s", strerror(saved));
2347 }
2348 /* Create the socket. */
2349 sock = socket(AF_UNIX, SOCK_STREAM, 0);
2350 if (sock < 0)
2351 packet_disconnect("socket: %.100s", strerror(errno));
2352
2353 /* Bind it to the name. */
2354 memset(&sunaddr, 0, sizeof(sunaddr));
2355 sunaddr.sun_family = AF_UNIX;
2356 strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2357 sizeof(sunaddr.sun_path));
2358
2359 if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2360 packet_disconnect("bind: %.100s", strerror(errno));
2361
2362 /* Restore the privileged uid. */
2363 restore_uid();
2364
2365 /* Start listening on the socket. */
2366 if (listen(sock, 5) < 0)
2367 packet_disconnect("listen: %.100s", strerror(errno));
2368
2369 /* Allocate a channel for the authentication agent socket. */
fa08c86b 2370 newch = channel_new("auth socket",
2371 SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
2372 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
2373 0, xstrdup("auth socket"), 1);
2374
a408af76 2375 strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2376 sizeof(channels[newch].path));
fa649821 2377 return 1;
8efc0c15 2378}
2379
2380/* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2381
6ae2364d 2382void
188adeb2 2383auth_input_open_request(int type, int plen, void *ctxt)
8efc0c15 2384{
5260325f 2385 int remch, sock, newch;
2386 char *dummyname;
2387
7368a6c8 2388 packet_integrity_check(plen, 4, type);
2389
5260325f 2390 /* Read the remote channel number from the message. */
2391 remch = packet_get_int();
2392
aa3378df 2393 /*
2394 * Get a connection to the local authentication agent (this may again
2395 * get forwarded).
2396 */
5260325f 2397 sock = ssh_get_authentication_socket();
2398
aa3378df 2399 /*
2400 * If we could not connect the agent, send an error message back to
2401 * the server. This should never happen unless the agent dies,
2402 * because authentication forwarding is only enabled if we have an
2403 * agent.
2404 */
5260325f 2405 if (sock < 0) {
2406 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2407 packet_put_int(remch);
2408 packet_send();
2409 return;
2410 }
2411 debug("Forwarding authentication connection.");
2412
aa3378df 2413 /*
2414 * Dummy host name. This will be freed when the channel is freed; it
2415 * will still be valid in the packet_put_string below since the
2416 * channel cannot yet be freed at that point.
2417 */
5260325f 2418 dummyname = xstrdup("authentication agent connection");
2419
2420 newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2421 channels[newch].remote_id = remch;
2422
2423 /* Send a confirmation to the remote host. */
2424 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2425 packet_put_int(remch);
2426 packet_put_int(newch);
2427 packet_send();
8efc0c15 2428}
7e7327a1 2429
2430void
0b242b12 2431channel_start_open(int id)
7e7327a1 2432{
2433 Channel *c = channel_lookup(id);
2434 if (c == NULL) {
2435 log("channel_open: %d: bad id", id);
2436 return;
2437 }
0b242b12 2438 debug("send channel open %d", id);
7e7327a1 2439 packet_start(SSH2_MSG_CHANNEL_OPEN);
2440 packet_put_cstring(c->ctype);
2441 packet_put_int(c->self);
2442 packet_put_int(c->local_window);
2443 packet_put_int(c->local_maxpacket);
0b242b12 2444}
2445void
2446channel_open(int id)
2447{
2448 /* XXX REMOVE ME */
2449 channel_start_open(id);
7e7327a1 2450 packet_send();
7e7327a1 2451}
2452void
2453channel_request(int id, char *service, int wantconfirm)
2454{
2455 channel_request_start(id, service, wantconfirm);
2456 packet_send();
2457 debug("channel request %d: %s", id, service) ;
2458}
2459void
2460channel_request_start(int id, char *service, int wantconfirm)
2461{
2462 Channel *c = channel_lookup(id);
2463 if (c == NULL) {
2464 log("channel_request: %d: bad id", id);
2465 return;
2466 }
2467 packet_start(SSH2_MSG_CHANNEL_REQUEST);
2468 packet_put_int(c->remote_id);
2469 packet_put_cstring(service);
2470 packet_put_char(wantconfirm);
2471}
2472void
2473channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2474{
2475 Channel *c = channel_lookup(id);
2476 if (c == NULL) {
2477 log("channel_register_callback: %d: bad id", id);
2478 return;
2479 }
2480 c->cb_event = mtype;
2481 c->cb_fn = fn;
2482 c->cb_arg = arg;
2483}
2484void
2485channel_register_cleanup(int id, channel_callback_fn *fn)
2486{
2487 Channel *c = channel_lookup(id);
2488 if (c == NULL) {
2489 log("channel_register_cleanup: %d: bad id", id);
2490 return;
2491 }
2492 c->dettach_user = fn;
2493}
2494void
2495channel_cancel_cleanup(int id)
2496{
2497 Channel *c = channel_lookup(id);
2498 if (c == NULL) {
2499 log("channel_cancel_cleanup: %d: bad id", id);
2500 return;
2501 }
2502 c->dettach_user = NULL;
2503}
2e73a022 2504void
2505channel_register_filter(int id, channel_filter_fn *fn)
2506{
2507 Channel *c = channel_lookup(id);
2508 if (c == NULL) {
2509 log("channel_register_filter: %d: bad id", id);
2510 return;
2511 }
2512 c->input_filter = fn;
2513}
7e7327a1 2514
2515void
a22aff1f 2516channel_set_fds(int id, int rfd, int wfd, int efd,
2517 int extusage, int nonblock)
7e7327a1 2518{
2519 Channel *c = channel_lookup(id);
2520 if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2521 fatal("channel_activate for non-larval channel %d.", id);
a22aff1f 2522 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
7e7327a1 2523 c->type = SSH_CHANNEL_OPEN;
7e7327a1 2524 /* XXX window size? */
bcbf86ec 2525 c->local_window = c->local_window_max = c->local_maxpacket * 2;
7e7327a1 2526 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2527 packet_put_int(c->remote_id);
2528 packet_put_int(c->local_window);
2529 packet_send();
2530}
This page took 0.510978 seconds and 5 git commands to generate.